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Abstract 

The Piranha Solution® is a complex and valuable integrated chemical supply inventory management 
system protected as a trade secret by its asset holder, the Confluence Corporation. The Piranha program 
is the lifeblood of the corporation's growth and success in the chemical supply industry. A common 
definition of trade secret is "any information you don't want your competitors to have," and this 
statement couldn't be truer for the much sought after Piranha Solution®. The advantage of a trade 
secret is the potential to keep unique details of an invention a secret forever, as opposed to alternative 
protections such as a patent, which require public disclosure. But in order to retain assets as trade 
secrets, the holding company must take "reasonable steps" to insure the security and secrecy of 
undisclosed, unique details. These steps for Intellectual property security inevitably include a computer 
and information system component, especially when the asset is digital, as is the case with the Piranha 
Solution®. In this case, while Confluence Corporation appropriately focuses on, and continuously 
monitors for, external threats to the Piranha Solution®, internal threats that may compromise the 
system are largely ignored. Failure to take proper precautions to protect their assets, a not uncommon 
business scenario, will ultimately be disastrous for the company. How to identify and avoid missing 
these important issues, and what reasonable steps may be taken to protect corporate intangible assets, 
is the focus of this case study based on actual events known to the authors. 

Keywords: IS Strategy and Management, IS Security, Intangible Assets, Trade Secrets, IS Policy & 
Protections. 


1. GOOD EVENING CONFLUENCE 
CORPORATION 

The late-night summer celebration at Confluence 
Corporation headquarters in Saint Louis, 
Missouri, was a spectacular affair. Tables set up 
in the 14th floor conference hall were covered 


with linens in the company's trademark indigo 
blue, and laden with heaping plates of gourmet 
cheeses, smoked salmon, and bite-sized filet 
mignon. There were cobalt crystal glasses to dip 
into the champagne fountain, and even some 
appetizers with a Trinidadian influence to honor 
the company's co-founders: curried shrimp, aloo 
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pies, and raw oysters bathed in a sweet-hot 
cilantro sauce. The party marked the opening of 
the newest corporate branch of Confluence (in 
Hawaii) and concurrently the hiring of the 
corporation's 100th sales staff employee. 
Business was booming, and the Confluence family 
was growing and celebrating amid the glow of 
what seemed to be unstoppable success. 

Although adding a new office is an important 
milestone, the summer evening had an even 
stronger basis for celebration; Confluence 
Corporation was quickly rising to become a 
national leader in the chemical supply industry. 
Growing at a rate of over 15% per year, the 
burgeoning company was divided among two 
dozen U.S. branch sales offices and distribution 
sites, each with its own sales staff of a manager 
and an average of 4-6 trained personnel. 
Confluence employees all knew the key to the 
corporation's exponential success was a complex 
and highly coveted trade secret inventory system 
known as the Piranha Solution®. The program, 
dubbed after the strongly oxidizing chemical 
mixture of Hydrogen peroxide and Sulfuric acid 
used to clean organic residues (as well as the tiny 
Amazonian razor-toothed fish), was a marvel of 
ingenuity. Its multi-layered secure design 
tracked hundreds of thousands of compounds, 
hazard classifications, and compliance data. The 
system also had the capacity to interface with the 
over 60,000 chemical classifications in the 
OSHA/EPA (Occupational Safety and Health 
Administration / Environmental Protection 
Agency) Toxic Substances Control Act inventory, 
as well as track signature verification for 
regulatory compliance. Competitors of 
Confluence begged for licensing of the system, 
but co-founder and CEO Dr. Devlin Khan knew 
his valuable inventory program was the best in 
the country, maybe even the world. Dr. Khan 
had considered the potentially lucrative licensing 
route at one time in the early stage launch of 
Piranha, even providing access in the form of a 
"sneak peek" to a staunch competitor. He quickly 
retracted his flirtation with licensing, however, 
upon the realization that the Piranha system 
possessed a once-in-a-lifetime uniqueness that 
was unlikely to ever be duplicated. Born in 
Trinidad, Dr. Khan had cut his teeth on the 
chemical exports of ammonia and methanol for 
which his home country was well known. The 
company's Piranha Solution® was the 
"confluence" of CEO Devlin's chemical knowledge 
and the computer programming expertise of his 
wife Dr. Tamika Sunil-Khan, also a Trinidad 
native. Together the Drs. Khan built a powerful 
chemical supply domain around the tremendously 
intricate Piranha—no system came even remotely 


close to mimicking its efficiency, safety and pure 
elegance. 

2. ONE BIG CONFLUENT FAMILY 

As Confluence Corporation continued to 
accelerate its expansion, employees were added 
to the sales force at a phenomenal rate. Other 
chemical supply companies were hemorrhaging 
from the loss of their best salesmen and women 
to the Khan Empire. Because the company was 
growing so quickly, it was imperative to have the 
sales force "hit the ground running" with a clear 
understanding of both the inventory and its 
management via Piranha. All members of the 
Confluence sales force were therefore trained on 
Piranha Solution® and each had open access to 
the system. Although Tamika and her team had 
established elaborate security from external 
threats for the inventory program (spurred by the 
intense interest of previously mentioned 
competitors, both honest and not-so-much-so), 
the Confluence in-house family of employees and 
founders didn't see a need for internal security. 
Insider activity against the company was viewed 
as unthinkable. 

As a result of this culture of confidence, 
Confluence didn't require its sales personnel to 
sign non-competition agreements, which could 
potentially limit employees from leaving the 
company for a direct competitor (and possibly 
taking Piranha secrets with them). The Khans 
knew that there was nothing like the Piranha 
Solution® at any other chemical supply company, 
and it was this precise asset that was driving 
unprecedented sales and profits. Salespersons 
were "beating down the door" to secure a position 
at Confluence, and knew they would be foolish to 
go anywhere else once they were on board. 

The corporation also didn't see a need to have 
employees sign agreements to keep details of the 
Piranha Solution® a secret. It was an unspoken 
rule that everyone protected the system that the 
Khans had so carefully constructed; it would have 
been offensive to require Confluence "family" 
members to sign a document that, by its nature, 
called into question their loyalty and dedication to 
the company. 

Therefore because of this unprecedented culture 
of trust, the usual safeguards for a trade secret 
like the Piranha software, such as restricted 
access and confidentiality agreements, were 
completely absent. Yet the Khans were confident 
that their prized system was impervious to any 
threat, either internal or external. 
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3. THE PARTY'S OVER 

It was on a sultry, warm Tuesday night in June 
that a breach of the Confluence comfort zone 
would first materialize. Tamika Khan was working 
late that evening at company headquarters in St. 
Louis. Devlin had already left the office for their 
brownstone townhouse in Soulard, and was 
expecting his wife to follow him home shortly. As 
Tamika was preparing to shut down systems at 
around 2AM, out of curiosity she checked the 
branch access logs to see if anyone else was 
working late. It was midnight at the company 
shop farthest continental west in Happy Valley, 
Oregon, and all was quiet. The same was true of 
branches in Montana and Iowa. In Confluence 
sub-headquarters Austin, Texas, not a creature 
was stirring either. All was also tucked away in 
Florida, West Virginia and Illinois. Feeling tired, 
Tamika had just decided to head home when 
something in the Indiana branch logs caught her 
eye. Multiple logons beginning just after midnight 
central time were scrolling on the screen— 
12:21AM, 12:24AM, 12:31AM-and on and on 
well past 1AM. Tamika smiled to herself when she 
saw the access times. "Our employees are so 
dedicated," she thought. She put the system to 
bed and headed home. 

Just before 8AM the next day, Devlin Khan's 
mobile phone rang. On the line was Confluence's 
Midwest regional branch manager Evelyn 
Connors, who was just leaving the Iowa office. 
Evelyn checked in with each branch on a weekly 
basis, sometimes even flying to a location to look 
in on operations, the sales manager, and staff. 
"Dr. Khan I haven't been able to raise the Indiana 
shop yesterday or today," she said, sounding a bit 
concerned. "I was going to fly out there Monday, 
but Kevin said they were in training this week. No 
one is answering the office phone, and I'm not 
receiving a response on anyone's cell phone 
either." Kevin Roth was the Evansville, Indiana 
branch manager who had come on board about 
six months earlier. He had a stellar record in 
chemical sales and more than 10 years of 
management experience. Kevin's last position 
was working for the mid-sized chemical supplier 
Cold River Chemicals, located in northern 
Indiana. Aside from a good bit of complaining 
about his lack of bonus this past quarter (During 
his short tenure with the company, Kevin had 
driven the Evansville office to its highest sales 
numbers to date. However, he had missed the 
six-month corporate residency requirement to 
receive a much anticipated $25,000 quarterly 
bonus by two weeks. Kevin felt that he had more 
than made up for those missing ten days through 
late night shifts and weekend hours.) Kevin was 


overall an excellent manager, and well-liked by 
his administrative and sales staff. He had a 
natural charm and ways of motivating his Indiana 
group to aspire to greatness. And, in keeping 
with the Confluence culture of loyalty, the 
Evansville employees would follow Kevin's every 
command without question. 

Devlin hung up with Evelyn and tried himself to 
contact the Evansville office, then Kevin, and 
finally the assistant sales manager, Matthew 
Langenstein. He, like Evelyn, did not receive a 
single response. After speaking to Tamika, who 
was down the hallway in her office, Devlin called 
Evelyn back. "Instead of returning to Missouri 
today, please head to Indiana. We just need to 
be sure everything is okay over there." 

Tamika asked her administrative assistant Renee 
to keep trying to contact the Indiana branch. 
Tamika then quickly remembered the logon 
access from the previous evening. Turning to her 
system, she looked back over access logs from 
the prior few days for the Evansville branch. The 
record there also showed multiple odd hours 
logons—times such as 2:32AM or 3:40AM—highly 
unusual even for a motivated and diligent 
workforce. Tamika called Devlin—"We may have 
a problem in Indiana." She then consulted with 
her top technical programmer Martin Salaam. 
Martin had designed the impenetrable external 
protections for the Piranha Solution® and had 
extensive experience with computer forensics. 
Tamika charged Martin with finding out what was 
going on in Indiana. "Please tell me it is nothing," 
she pleaded silently. 

4. SAINT LOUIS, WE HAVE A PROBLEM 

Evelyn was able to book a 9AM flight from Cedar 
Rapids to Evansville, but the flight would take 3 
hours. "I can drive there faster," Devlin thought 
aloud. Tamika was now in his office, pacing the 
room and looking out the east windows at the 
arch and city skyline. "We should wait for Evelyn, 
it is likely nothing important," she said nervously. 
As the minutes ticked away, Martin was 
discovering more and more alarming signs 
indicating that there was far from "nothing" going 
on in Indiana. But, because the company 
periodically deleted its system back-ups, he could 
only investigate so far. He did see, however, that 
the odd hours access was coming from two 
specific locations—one inside the Evansville 
branch, and the other in northern Indiana. 

At half past noon, Devlin, Tamika and Martin were 
all eyes glued to Martin's computer screen when 
the call from Evelyn came. "The outer door was 
locked when I arrived. I'm inside the office now, 
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and it is empty—no people, all the desks cleared 
out, nothing." She stumbled over a moving box 
while she talked and roamed around the silent 
space. "Everyone, and everything associated 
with them, is gone." Tamika and Devlin looked at 
each other incredulously. How could this happen? 
Why? What do we do now? 

A few days after the police incident report was 
filed, branch surveillance video showed 
Confluence employees loading a U-Haul truck 
with boxes and materials from the Evansville 
office. While the furniture, computers and desks 
remained in the building, a few files and written 
materials—including a proprietary print Piranha 
Solution® training manual—were missing. Even 
though a copyright instantly attaches to written 
materials when they are created, the Khans didn't 
have time to register the copyright for Piranha 
Solution® support materials, a requirement to 
bringing legal action for violations. With open 
access to the inventory program, many 
employees also had Piranha materials, including 
the training manual, on their mobile phones and 
laptops; none of these personal devices belonged 
to Confluence. Martin and Tamika surmised— 
from the little activity data they could recover— 
that in the days before the move, Evansville 
employees were downloading files pertaining to 
Piranha. Additionally, there was increased email 
traffic between Evansville employees in the two 
weeks before their departure, which was also 
unusual for their independent, highly trained 
sales force. An issue slowing the investigation 
was the fact that, for simplification of access, all 
employees at a branch used the same user name 
and password. Therefore due to the lack of 
unique identifiers, it was impossible to tell from 
the logs which employee was in the system at any 
given time. 

The Khans were devastated; all indications 
suggested that the highly prized and sought after 
Piranha Solution® trade secret had been 
compromised in the most egregious fashion—by 
members of the Confluence family. Further 
investigation revealed that sales manager Kevin 
Roth was more than nominally upset about his 
lack of bonus, especially as he knew that the 
Illinois branch manager had received a $10k 
award for the first quarter for sales numbers 
inferior to those his office had attained. Without 
an employment contract, internal system 
safeguards, or a non-competition agreement 
from Confluence to modulate his behavior, Kevin 
had taken his sales skills, sales staff, and sales 
system to greener pastures in northern Indiana. 
Mr. Roth and his group were found a few months 
later to be operating a chemical supply company 


under the name "Roth Chemical" just north of 
Indianapolis. As a final insult, the hallmark of the 
new company was an incredible inventory system 
called the Caiman Solution™, named for a 
voracious Amazonian predator of the piranha fish. 

5. QUESTIONS 

1. What are some internal threats to the Piranha 
Solution ®? 

b. List some protective measures that can be 
taken to address those threats. 

c. Was Confluence Corporation doing enough 
to protect against these potential threats? 

2 What are some external threats to the 
Piranha Solution ®? 

b. List some protective measures that can 
be taken to address those threats. 

c. Was Confluence Corporation doing 
enough to protect against these potential 
threats? 

3. What network monitoring and security tools 
could have been used to protect the system? 
What are some open source options? 

4. Imagine you are a co-founder of Confluence 
Corporation when it was just a start-up. 
What policies would you establish to protect 
the company and Piranha Solution ®? 

a. A "trade secret" like the Piranha 
Solution® may be defined as "a formula, 
practice, process, design, instrument, 
pattern, or compilation of information 
that has independent economic value in 
being not generally known or reasonably 
ascertainable (that is, the secret gives the 
owner some actual or potential 
competitive advantage)." In order to 
maintain trade secret protection, a 
company must take reasonable steps to 
keep undisclosed details a secret. 
Research and list five reasonable steps 
that a corporation can take to protect a 
trade secret (Lin, 2012). 

b. Did Confluence Corporation take any of 
the steps you've listed? 

c. What could the corporation have done to 
better protect Piranha Solution ®? 
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